geenforce: fix http-payload path doubling + sweep stale kiosk startup shortcuts

- Resolve-ShopdbPayloads wrote an absolute local path into the entry, and the
  engine resolves it as Join-Path InstallerRoot <field>, doubling it
  (C:\...\payloads\C:\...\payloads\<sha>.ps1 -> PS1 not found). Write the leaf
  filename instead; the runner already sets InstallerRoot to that payloads dir.
- display dispatcher now removes leftover kiosk launchers from prior installs
  (any Startup .lnk that runs Edge --kiosk, plus .url to a shopdb kiosk page),
  not just its own, so two kiosks do not fight.

plugins/geenforce/client/ShopdbEnforceClient.psm1

@@ -313,8 +313,13 @@ function Resolve-ShopdbPayloads {
         $ref = Get-ShopdbProperty $entry 'PayloadRef'
         $local = Get-ShopdbPayload -Sha256 $sha -Config $Config -Filename $ref -CacheDir $CacheDir
         if (-not $local) { throw "payload $sha for '$($entry.Name)' could not be fetched/verified" }
-        if ($entry.PSObject.Properties.Name -contains $field) { $entry.$field = $local }
-        else { $entry | Add-Member -NotePropertyName $field -NotePropertyValue $local }
+        # Write the LEAF filename, not the absolute path: the engine resolves the
+        # entry field as Join-Path $InstallerRoot <field>, and the runner sets
+        # InstallerRoot to this same payloads dir. Passing an absolute path made
+        # the engine double it (InstallerRoot + C:\...\ -> C:\...\C:\...).
+        $leaf = Split-Path -Leaf $local
+        if ($entry.PSObject.Properties.Name -contains $field) { $entry.$field = $leaf }
+        else { $entry | Add-Member -NotePropertyName $field -NotePropertyValue $leaf }
         $changed = $true
     }
     if (-not $changed) { return $ManifestPath }